<%= post.title %>
<%= post.body %>
<% if show_admin_options && policy(post).update? %>
<%= link_to 'Edit', edit_post_path(post) %>
<%= link_to 'Delete', post_path(post), method: :delete %>
<% end %>
```
--------------------------------
### Get Policy Instance
Source: https://github.com/varvet/pundit/blob/main/_autodocs/api-reference/MainModule.md
Retrieves the policy for a record. This method does not raise an error if the policy is not found, returning `nil` instead. Useful for checking permissions conditionally.
```ruby
policy = Pundit.policy(user, post)
if policy
if policy.update?
# Allow update
end
else
# No policy found
end
```
--------------------------------
### Get Policy Suffix
Source: https://github.com/varvet/pundit/blob/main/_autodocs/api-reference/MainModule.md
Retrieve the default suffix appended to class names to find policy classes. Note: `Pundit::PolicyFinder::SUFFIX` is the recommended alternative.
```ruby
Pundit::SUFFIX # => "Policy"
```
--------------------------------
### Usage in Context
Source: https://github.com/varvet/pundit/blob/main/_autodocs/api-reference/CacheStore.md
Demonstrates how to pass cache stores to Pundit::Context during initialization.
```APIDOC
## Usage in Context
Cache stores are passed to `Pundit::Context` at initialization:
```ruby
# No caching (default)
context = Pundit::Context.new(user: user)
# With custom cache
cache = Pundit::CacheStore::LegacyStore.new({})
context = Pundit::Context.new(user: user, policy_cache: cache)
```
```
--------------------------------
### Custom pundit_params_for for JSON API spec
Source: https://github.com/varvet/pundit/blob/main/README.md
Example of overriding `pundit_params_for` to handle parameter fetching according to the JSON API specification, targeting the `attributes` hash.
```ruby
# If you are using something like the JSON API spec
def pundit_params_for(_record)
params.fetch(:data, {}).fetch(:attributes, {})
end
```
--------------------------------
### I18n Configuration for Pundit Errors
Source: https://github.com/varvet/pundit/blob/main/README.md
Example YAML configuration for internationalizing Pundit error messages, mapping policy names and queries to specific user-facing strings.
```yaml
en:
pundit:
default: 'You cannot perform this action.'
post_policy:
update?: 'You cannot edit this post!'
create?: 'You cannot create posts!'
```
--------------------------------
### Scope Collections: Basic Scope
Source: https://github.com/varvet/pundit/blob/main/_autodocs/QUICK-START.md
Define a `Scope` class within your policy to control which records are returned by `policy_scope`. This example scopes posts to only published ones.
```ruby
class PostPolicy
class Scope
def initialize(user, scope)
@user = user
@scope = scope
end
def resolve
@scope.where(published: true)
end
end
end
# In controller
@posts = policy_scope(Post.all)
```
--------------------------------
### View Helper for Headless Policy
Source: https://github.com/varvet/pundit/blob/main/README.md
Shows how to use the `policy` helper in a view to check authorization for a headless policy, using a symbol to represent the concept.
```erb
# In views
<% if policy(:dashboard).show? %>
<%= link_to 'Dashboard', dashboard_path %>
<% end %>
```
--------------------------------
### Complex Scoping Logic
Source: https://github.com/varvet/pundit/blob/main/_autodocs/api-reference/Policies.md
An example of a complex `Scope` class that resolves collections based on user roles (admin, moderator, author) with different filtering criteria.
```ruby
class PostPolicy
class Scope
attr_reader :user, :scope
def initialize(user, scope)
@user = user
@scope = scope
end
def resolve
case @user.role
when 'admin'
@scope.all
when 'moderator'
@scope.where.not(status: 'spam')
when 'author'
@scope.where(author_id: @user.id).or(
@scope.where(published: true)
)
else
@scope.where(published: true)
end
end
end
end
```
--------------------------------
### Minimal Policy Structure
Source: https://github.com/varvet/pundit/blob/main/_autodocs/api-reference/Policies.md
Defines a basic policy class with an initializer and query methods for viewing, updating, and destroying a post.
```ruby
class PostPolicy
def initialize(user, post)
@user = user
@post = post
end
def show?
true # Everyone can view posts
end
def update?
@post.author == @user # Only author can edit
end
def destroy?
@user.admin? # Only admins can delete
end
end
```
--------------------------------
### Policy Scope Resolution
Source: https://github.com/varvet/pundit/blob/main/_autodocs/types.md
Example of implementing the `resolve` method within a policy's Scope class to filter a collection. This method should return the filtered scope.
```ruby
class RecordPolicy
class Scope
def initialize(user, scope)
@user = user
@scope = scope
end
def resolve
# Return filtered collection
@scope.where(public: true)
end
end
end
```
--------------------------------
### Get Scope Class
Source: https://github.com/varvet/pundit/blob/main/_autodocs/api-reference/PolicyFinder.md
Retrieve the policy scope class for the object. Returns nil if no scope is found. The scope class should respond to #initialize(user, record) and #resolve.
```ruby
finder = Pundit::PolicyFinder.new(post)
scope_class = finder.scope # => PostPolicy::Scope
# Use the scope
scope = scope_class.new(user, Post.all)
scoped_posts = scope.resolve # Returns filtered posts
```
--------------------------------
### Base ApplicationPolicy Class
Source: https://github.com/varvet/pundit/blob/main/_autodocs/api-reference/Policies.md
Defines a base `ApplicationPolicy` with common authorization logic for user, record, and scope initialization. Includes default implementations for actions like `show?`, `create?`, `update?`, and `destroy?`.
```ruby
class ApplicationPolicy
attr_reader :user, :record
def initialize(user, record)
@user = user
@record = record
end
def show?
true
end
def create?
user.present?
end
def new?
create?
end
def update?
user.present? && (record.user == user || user.admin?)
end
def edit?
update?
end
def destroy?
user.admin?
end
class Scope
def initialize(user, scope)
@user = user
@scope = scope
end
def resolve
@scope
end
end
end
```
--------------------------------
### Customizing NotAuthorizedError Messages
Source: https://github.com/varvet/pundit/blob/main/README.md
Connect Pundit's NotAuthorizedError properties with I18n to generate dynamic error messages. This example shows how to implement a rescue_from method in ApplicationController.
```ruby
class ApplicationController < ActionController::Base
rescue_from Pundit::NotAuthorizedError, with: :user_not_authorized
private
def user_not_authorized(exception)
policy_name = exception.policy.class.to_s.underscore
flash[:error] = t "#{policy_name}.#{exception.query}", scope: "pundit", default: :default
redirect_back_or_to(root_path)
end
end
```
--------------------------------
### Policy Method: Allow Everyone
Source: https://github.com/varvet/pundit/blob/main/_autodocs/QUICK-START.md
Implement a policy method that always returns true to grant access to all users. Use this for public-facing actions.
```ruby
def show?
true
end
```
--------------------------------
### Using policy_scope in ERB Views
Source: https://github.com/varvet/pundit/blob/main/README.md
Provides an example of how to use the `policy_scope` method directly within an ERB view to iterate over records that have been filtered by their respective policy scopes.
```erb
<% policy_scope(@user.posts).each do |post| %>